In some computer systems it is often important to verify the authenticity of code before it is executed. In such computer systems code might only be executed if it is known to be from a trusted source. The computer system requires a mechanism of verifying that code is from a trusted source, rather than an untrusted source, before executing the code.
For example, digital TV set top boxes (STBs) are designed to decode content streams transmitted by broadcasters, and display them on a television screen. Many of these content streams are transmitted in an encrypted format, and they have to be decrypted before they can be displayed. Only true subscribers who have paid for the service are given permission to decrypt and view the content. Security features on the STB prevent non-subscribers from being able to decrypt and view the content streams. For this system to work effectively, it must be ensured that the STB is not bypassing the security features. Most STBs use programmable microprocessors, so in order to ensure that the security features are not bypassed, it is necessary to verify that code running on the microprocessors has come from a trusted source.
One method of ensuring the authenticity of code is to encode the code into a Read Only Memory (ROM) embedded in a chip of a computer system. This ensures the security of the code since it is very difficult to modify code stored in ROM. Therefore, chips can be supplied from a trusted supplier with code prestored in the ROM, such that the computer system can trust the code stored in the ROM.
However, storing code in ROM requires the code to be fixed at the time of manufacture, such that it cannot be changed at a future date. Storing code in this rigid manner in ROM is often undesirable, as developments or improvements to the code cannot be made after manufacture.
In order to allow developments or improvements to be made to code after manufacture, the code can be loaded from an external programmable memory. In this way, new developments or improvements to the code could be loaded into the external memory, and then loaded into the chip from the external memory. However, such a system would be less secure than that in which ROM on the chip is used because the code stored in the external memory might not come from a trusted source or the external memory could be replaced with a different, untrusted memory. In either of these ways, untrusted code could be loaded into the chip.
It is an aim of the present invention to provide a solution to the above mentioned problems of ensuring the security of code loaded into a chip.